CVE-2024-54031: 
Linux Kernel vulnerability analysis and mitigation

CVE-2024-54031 affects the Linux kernel's netfilter component, specifically related to an unaligned atomic read issue in the nft_set_hash functionality. The vulnerability was discovered and disclosed on January 15, 2025, affecting the struct nft_set_ext implementation in the netfilter subsystem (NVD).

The vulnerability stems from an unaligned atomic read access to the genmask field in struct nft_set_ext, which can result in alignment faults on certain architectures. The issue manifests when accessing the genmask field, causing kernel paging requests to fail with an alignment fault (ESR = 0x0000000096000021). The problem occurs specifically in the nft_rhash_gc function within the nf_tables module (Kernel Commit).

When triggered, this vulnerability can cause a kernel panic due to an unaligned memory access, leading to a system crash. This primarily affects systems using the netfilter subsystem with nftables hash sets. The issue increases the size of elements for rhash and pipapo by 8 bytes on x86_64 architectures (Kernel Commit).

The issue has been fixed by aligning the struct nft_set_ext to word size using the __aligned(BITS_PER_LONG / 8) attribute. This fix has been incorporated into various Linux kernel versions, including 5.10.234-1 and 6.1.128-1~deb11u1 for Debian systems (Debian LTS).